BILL NO19: A SMALL REVOLUTION IN MEDICAL DATA

On December 3^rd, the Minister of Health and Social Services, Mr. Christian Dubé, introduced Bill 19 – An Act respecting health and social services information and amending various legislative provisions – (“Bill 19“)[1] which significantly modernizes privacy within the health and social services system.

The purpose of Bill 19 is to establish a legal framework specific to health and social services information (“HSSI“) inorder to (i) protect individuals’ data and (ii) determine who may use HSSI and under what conditions. The latter is particularly important, as Bill 19 provides that, under certain conditions, HSSI may be used without the consent of the individual, even for purposes other than those for which it was initially collected (e.g., for research purposes).

This is certainly an imposing reform: Bill 19 provides for the creation of a national system for the deposit of HSSI, as well as various pan-Quebec registries, in order to facilitate access to and the keeping of records on users of the health and social services system. The aim is to push the Dossier Santé Québec project – whose constitutive law is repealed by Bill 19 [2]– further, in order to alleviate the problem of information that contributed to the crisis in long term care centers (CHSLD) and the difficult management of the Covid-19 pandemic.[3]

The Definition of Health and Social Services Information

The first contribution of Bill 19 is to define what is HSSI[4], since such definition is absent in both Dossier Québec’s constitutive law[5] and the Act Respecting Health Services and Social Services[6]:

[…] health or social services information is any information held by a health and social services body that concerns a person, whether or not it allows the person to be identified, and that has one of the following characteristics:

(1) it concerns the person’s state of physical or mental health and his or her health determinants, including his or her medical or family history;

(2) it concerns any material, including biological material, collected in the context of an assessment or treatment, and any implants, ortheses, prostheses or other aids that compensate for the person’s disability;

(3) it concerns the health services or social services provided to the person, including the nature of those services, their results, the location where they were provided and the identity of the persons or bodies that provided them;

(4) it was obtained in the exercise of a function under the Public Health Act (chapter S-2.2); or

(5) any other characteristic determined by government regulation.

Despite the first paragraph, information concerning a personnel member of the body or a professional practising his or her profession within the body, […], is not HSSI when it is collected by that body for human resources management purposes.

In addition, information allowing a person to be identified, such as the person’s name, date of birth, contact information, health insurance number or any other information of the same nature, is HSSI when it is next to information referred to in the first paragraph or when it is collected for registration, enrolment or admission of the person concerned to or at a health and social services institution or for the taking in charge of the person concerned by another health services or social services body.

[Emphasis added]

It should be noted that, contrary to the “traditional” definition of personal information within the meaning of privacy legislation[7], HSSI is any information referred to in any of subsection 1 to 5, whether or not it identifies an individual. This is a particularly important distinction, since it is now possible with artificial intelligence algorithms to re-identify an individual from certain allegedly anonymous medical data.